Somewhere in San Antonio there’s an Everglades speedboat worth somewhere between $150,000 and $300,000. The name on the hull is The Payoff.

That boat belongs to none other than Chris Hannifin. The retired Air Force officer, former chief information officer at multiple cybersecurity firms, and the man many suspect of espionage, money laundering, and most egregiously of all the sale of sensitive government and corporate data to hostile foreign actors. Hannifin bought the boat within weeks of founding DefendIT Services in mid-2024, along with a high-end Jayco trailer and a $685,000 home in Bexar County priced roughly $300,000 above the neighborhood average. In total, Hannifin’s spending in less than six months was well over a million dollars. And then he named the boat.

Whether that tells you more about his arrogance or his judgment is worth sitting with.

Behavioral psychologist Paul Ekman spent over forty years studying how and why people lie, and he documented a phenomenon he called duping delight — the barely contained satisfaction a practiced liar feels when he’s successfully fooled the people around him. At high enough doses, the satisfaction stops being a feeling and becomes a need. The deceiver needs the secret almost known. Not confessed. Just close enough to the surface that keeping it hidden becomes its own kind of substance abuse — like a junkie who doesn’t want the high so much as the moment right before it.

Researchers at the Defense Personnel and Security Research Center, which spent decades profiling espionage and insider betrayal inside U.S. government and contractor environments, found something that cuts against how most people imagine these cases. Compromised insiders don’t generally get more careful as time passes. They get less careful. The longer the evasion, the more their sense of invulnerability compounds. That invulnerability starts leaking out into behavior the people around them can plainly see.

The spending is usually the first thing.

Aldrich Ames worked at the CIA for thirty years, the last nine of which he spent selling American intelligence to the Soviets. During those nine years he drove a $60,000 Jaguar to Langley every morning and built a $540,000 house on a government salary of $69,000. Colleagues noticed. Some of them made jokes about it. The institution looked past the obvious until it couldn’t, and when investigators finally started pulling the thread, his finances were the first and most damning thing they found.

Jeffrey Delisle was a Canadian Navy intelligence officer who for four years sold signals intelligence to Russian military intelligence for cash. He spent some of that money on a boat. He was eventually caught not because of any counterintelligence work on the Canadian side, but because the Americans tipped them off based on signals from the other direction. He’d been operating with almost no fear of discovery, and why would he — nobody was looking.

Both of them thought the same thing Hannifin appears to be thinking: that the space between what they were doing and what people could see was bigger than it actually was.

Former colleagues at North South Consulting Group described Hannifin’s behavior in the months before he left as increasingly erratic. Deranged was the word more than one of them used. He clashed with CEO Krista Stevens over management style and client selection and almost everything else, and the hostility behind closed doors was reportedly intense. DefendIT Services launched weeks later. Within months, Hannifin had spent a million dollars.

The purchases alone would’ve drawn attention. The boat name itself should have been a waving red flag.

Naming a speedboat The Payoff when you’re allegedly using illicit proceeds to buy it is not a mistake that happens to a careful person. It doesn’t happen to a nervous one either. It happens to someone who has started to believe they are operating outside the normal consequences of things. Behavioral researchers who study insider threats note that this kind of display — openly referencing the crime in everyday life — tends to cluster around a specific window: after the initial operation has worked, before the first real pressure arrives.

Hannifin was apparently in that window when he named the boat.

The pressure came eventually. Onlookers started connecting the spending to the timeline of DefendIT Services’ founding. Law enforcement began tracing the origin of his sudden wealth, his foreign contacts, the structure of an alleged kickback arrangement with a senior executive at RSM. Clients started leaving quietly. Neighbors of the DefendIT Services office reported it sitting mostly empty.

Hannifin registered a second company in Texas that August — Defend IT and Facilities Solutions — and brought in a new partner to go with it. Eric Diaz had run operations at DarkLattice Security and Cloud Info Systems. He was a name people in Texas IT actually knew. Which made his decision to sign on with DefendIT Services, given what was swirling around the firm, worth thinking about.

It has the shape of expansion. A new LLC, a known name. But a new LLC also puts legal distance between any misconduct claims attached to DefendIT Services and Hannifin’s personal assets — the house, the Jayco trailer, the boat with its name still on the hull. And bringing in Diaz shores up credibility that DefendIT Services had been bleeding for months. Competent moves. Reactive ones too, executed by a man who for the better part of a year bought expensive things and named them after what he was allegedly doing to earn the money.

The one thing about the Defend IT and Facilities play that hasn’t gotten much attention is what Eric Diaz knew before he agreed to come aboard. He’s a real professional with a real track record. If the allegations against Hannifin turn out to be true, Diaz either didn’t do much digging on his new partner, or he did the digging and signed on anyway.